42 lines
2.0 KiB
TypeScript
42 lines
2.0 KiB
TypeScript
import { ManualOperationAuditMiddleware } from './manual-operation-audit.middleware';
|
|
|
|
describe('ManualOperationAuditMiddleware', () => {
|
|
it('records a successful authenticated mutation without storing request bodies', async () => {
|
|
const prisma = { operationLog: { create: jest.fn().mockResolvedValue({ id: 'log-1' }) } };
|
|
const middleware = new ManualOperationAuditMiddleware(prisma as never);
|
|
let finish: (() => void) | undefined;
|
|
const response = { statusCode: 200, once: (_event: 'finish', listener: () => void) => { finish = listener; } };
|
|
const next = jest.fn();
|
|
|
|
middleware.use({
|
|
method: 'PUT',
|
|
originalUrl: '/api/admin/enterprise-applications/c12345678901234567890?view=full',
|
|
sessionUserId: 'user-1',
|
|
header: () => 'jest',
|
|
}, response, next);
|
|
finish?.();
|
|
await Promise.resolve();
|
|
|
|
expect(next).toHaveBeenCalled();
|
|
expect(prisma.operationLog.create).toHaveBeenCalledWith({
|
|
data: expect.objectContaining({
|
|
userId: 'user-1',
|
|
action: 'manual_operation.put',
|
|
resource: 'enterprise-applications',
|
|
resourceId: 'c12345678901234567890',
|
|
detail: { method: 'PUT', path: '/api/admin/enterprise-applications/c12345678901234567890', statusCode: 200 },
|
|
}),
|
|
});
|
|
});
|
|
|
|
it('does not record unauthenticated, read-only, or failed requests', () => {
|
|
const prisma = { operationLog: { create: jest.fn() } };
|
|
const middleware = new ManualOperationAuditMiddleware(prisma as never);
|
|
const response = { statusCode: 500, once: (_event: 'finish', listener: () => void) => listener() };
|
|
middleware.use({ method: 'POST', originalUrl: '/api/admin/test', sessionUserId: 'user-1', header: () => undefined }, response, jest.fn());
|
|
middleware.use({ method: 'GET', originalUrl: '/api/admin/test', sessionUserId: 'user-1', header: () => undefined }, response, jest.fn());
|
|
middleware.use({ method: 'POST', originalUrl: '/api/admin/test', header: () => undefined }, response, jest.fn());
|
|
expect(prisma.operationLog.create).not.toHaveBeenCalled();
|
|
});
|
|
});
|